Millbeck Communications Proroute H685t-w

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 8.8
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Millbeck Communications
• Equipment: Proroute H685t-w
• Vulnerabilities: Command Injection, Cross-site Scripting

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary commands on the device’s operating system.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Millbeck Communications Proroute H685t-w, a 4G router, are affected:

• Proroute H685t-w: Version 3.2.334

3.2 Vulnerability Overview

3.2.1 Improper Neutralization of Special Elements used in a Command (‘Command Injection’) CWE-77

There is a command injection vulnerability that may allow an attacker to inject malicious input on the device’s operating system.

CVE-2024-45682 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

3.2.2 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) CWE-79

This vulnerability occurs when user-supplied input is improperly sanitized and then reflected back to the user’s browser, allowing an attacker to execute arbitrary JavaScript in the context of the victim’s browser session.

CVE-2024-38380 has been assigned to this v

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.